Merge commit 'df07c07b3de0a5e8890078944de1eb5cb8372ef8'

* commit 'df07c07b3de0a5e8890078944de1eb5cb8372ef8':
  rtpdec_h263_rfc2190: Clear the stored bits if discarding buffered data

Merged-by: Michael Niedermayer <michaelni@gmx.at>

Merge commit '42181740a3972e17d0097d28fabc9a1a60322d47'

* commit '42181740a3972e17d0097d28fabc9a1a60322d47':
  rtpenc: Set the AVFMT_TS_NONSTRICT flag

Merged-by: Michael Niedermayer <michaelni@gmx.at>

Merge commit '01f251c44d83eedc819625d2caac9ff9697a085d'

* commit '01f251c44d83eedc819625d2caac9ff9697a085d':
  rtpenc: Set the timestamp properly when sending mpegts data, too

Merged-by: Michael Niedermayer <michaelni@gmx.at>

Merge commit 'f2c614e8c4a935b52bbf86819128d9e797230c20'

* commit 'f2c614e8c4a935b52bbf86819128d9e797230c20':
  srtpproto: fix option flag type

Merged-by: Michael Niedermayer <michaelni@gmx.at>

avcodec/indeo3: ensure offsets are non negative

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avfilter/vf_spp: add gbrp support

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avfilter/vf_spp: add gray8 support

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avfilter/vf_spp: Fix pointer type warning

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avcodec/adpcm: Check idelta

Fixes integer overflow
Fixes: signal_sigsegv_1b0a4da_1865_cov_2167818389_computer_anger.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

rtpdec_h263_rfc2190: Clear the stored bits if discarding buffered data

If we throw away the buffered incomplete frame, make sure to also
throw away the buffered bits of an incomplete byte at the same
time.

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>

rtpenc: Set the AVFMT_TS_NONSTRICT flag

In particular, when packetizing mpegts into rtp, the input packet
timestamp may come from more than one stream, which could cause
multiple packets be written with the same timestamp.

Signed-off-by: Martin Storsjö <martin@martin.st>

rtpenc: Set the timestamp properly when sending mpegts data, too

Signed-off-by: Martin Storsjö <martin@martin.st>

srtpproto: fix option flag type

Signed-off-by: Martin Storsjö <martin@martin.st>

avcodec/h264: Check *log2_weight_denom

Fixes undefined behavior
Fixes: signal_sigsegv_14768d2_2248_cov_3629497219_h264_h264___pi_20070614T182942.h264
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avcodec/hevc_ps: Check diff_cu_qp_delta_depth

Fixes undefined behavior
Fixes: asan_static-oob_17aa046_582_cov_1577759978_DBLK_G_VIXS_1.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avcodec/hevc: move qp_block_mask to where its used

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

wavdec: RIFX file format support

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avcodec/h264: Clear delayed_pic on deallocation

Fixes use of freed memory

Fixes: case5_av_frame_copy_props.mp4
Found-by: Michal Zalewski <lcamtuf@coredump.cx>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avcodec/hevc: clear filter_slice_edges() on allocation

This avoids use of uninitialized memory
Fixes: asan_static-oob_17aa046_582_cov_212287884_DBLK_G_VIXS_1.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avcodec/dcadec: Check that the added xch channel isnt already there

Fixes null pointer dereference
Fixes: signal_sigsegv_369609d_623_cov_2008234281_ES_6.1_16bit.dts
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Merge commit '456e93bfdd4cbc5e995dea415019abd0703d0e16'

* commit '456e93bfdd4cbc5e995dea415019abd0703d0e16':
  dashenc: Adjust the start time of a segment to the end of the previous segment

Merged-by: Michael Niedermayer <michaelni@gmx.at>

Merge commit '2f628d5943c12389c07d652d23d3916997f9f0f6'

* commit '2f628d5943c12389c07d652d23d3916997f9f0f6':
  dashenc: Write segment timelines properly if the timeline has gaps

Merged-by: Michael Niedermayer <michaelni@gmx.at>

dashenc: Adjust the start time of a segment to the end of the previous segment

This is the same adjustment that the mp4 muxer does to the start
timestamp of fragments, since the timestamp of a sample in an mp4
file is implicit from the sum of earlier sample durations.

This avoids gaps in the timeline (which can stop dash.js from
playing it back), and makes sure the timestamp on the segmenter
level matches what the mp4 muxer actually writes into the segments.

This is only an issue if the AVPacket duration of the last
packet of a segment doesn't point to the actual start timestamp
of the next packet (the first in the next segment).

Signed-off-by: Martin Storsjö <martin@martin.st>

dashenc: Write segment timelines properly if the timeline has gaps

Write a new start time if the duration of the previous segment
didn't match the start of the next one. Check that segments
actually are continuous before writing a repeat count.

This makes sure timestamps deduced from the timeline actually
match the real start timestamp as written in filenames (if
using a template containing $Time$).

Signed-off-by: Martin Storsjö <martin@martin.st>

avcodec/imc: dont read bits beyond the end

Fixes use of uninitialized memory

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avcodec/utils: check the private context class

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avcodec/indeo3: use signed variables to avoid underflow

Fixes out of array read
Fixes: signal_sigsegv_1b0a4da_1865_cov_2167818389_computer_anger.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

flacenc: calculate lower sum levels in-place.

Should improve cache usage and reduces stack usage.
Also reduces number of copies in case many levels
have the same number of bits.

Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>

libavutil: cosmetic: inserted spaces wherever necessary

Signed-off-by: Supraja Meedinti <supraja0493@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avcodec/h264: make the first field of H264Context an AVClass

Fixes use of freed memory
Fixes: asan_heap-uaf_3660f67_757_cov_1257014655_Hi422FR1_SONY_A.jsv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

swscale: increase yuv2rgb table headroom

Fixes out of array access
Fixes: case2_bad_read_yuv2rgbx32.mp4
Found-by: Michal Zalewski <lcamtuf@coredump.cx>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avformat/mov: fix integer overflow of size

Fixes: case1_call_stack_overflow.mp4
Found-by: Michal Zalewski <lcamtuf@coredump.cx>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avformat/mov: check atom nesting depth

Fixes call stack overflow
Fixes: case1_call_stack_overflow.mp4
Found-by: Michal Zalewski <lcamtuf@coredump.cx>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avcodec/utvideodec: Fix handling of slice_height=0

Fixes out of array accesses
Fixes: asan_heap-oob_25bcd7e_3783_cov_3553517262_utvideo_rgba_median.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

doc/filters: fix typos and spelling errors

Prompted-by: Carl Oxwall <@oxwall>
Signed-off-by: Lou Logan <lou@lrcd.com>

avcodec/xface: Add asserts to limit nb_words from becoming too large

Approved-by: Stefano Sabatini <stefasab@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avcodec/xface: correct the XFACE_MAX_* values

Fixes out of array access

Fixes: asan_stack-oob_32c12e5_2536_cov_2442316831_lena.xface
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avcodec/vmdvideo: Check len before using it in method 3

Fixes out of array access
Fixes: asan_heap-oob_4d23ba_91_cov_3853393937_128.vmd
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avformat/hlsenc: Use av_freep() to avoid leaving stale pointers in memory

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avformat/flvdec: Use av_freep() avoid leaving stale pointers in memory

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avformat/hdsenc: Use av_freep() avoid leaving stale pointers in memory

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

lavfi: add colorlevels filter

Signed-off-by: Paul B Mahol <onemda@gmail.com>

avformat/hlsenc: fix hls_write_trailer() on hls_start() failure

Close segment I/O context and append segment in hls_write_trailer() only
when segment I/O context is allocated.

Signed-off-by: Christian Suloway <csuloway@globaleagleent.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

snow_dwt: Don't try and free members of non-existent arrays

If allocation fails earlier on, and the next frame is processed,
the slice buffer could be left in a state where line and data_stack
have already been freed, or are otherwise null pointers.

Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>

vp9/x86: save one register on 32bit idct32x32.

Fixes build on win32.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Merge commit '6f4364aba9d70dc5fd9f1c88b9c03bf9ea893d40'

* commit '6f4364aba9d70dc5fd9f1c88b9c03bf9ea893d40':
  mov: Fix handling of zero-length metadata values

Conflicts:
libavformat/mov.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

ffmpeg: Check for subtitle_out malloc failure

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avcodec/tiffenc: Consistently use ADD_ENTRY1()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

mov: Fix handling of zero-length metadata values

Since 3cec81f4d4, a zero-length metadata value would try to
allocate 2*0 bytes, where av_malloc() returns NULL.

Always add one to the allocated length, to allow space for
a null terminator in the zero-length case.

Incidentally, this fixes fate-alac on RVCT 4.0, where a compiler
bug seems to mess up the mov muxer to the point that it writes
the wrong sort of metadata. Previously this bug was undetected,
but since 3cec81f4d4 such mov files started returning
AVERROR(ENOMEM) in the mov demuxer.

Signed-off-by: Martin Storsjö <martin@martin.st>

Merge commit '10d4c5e55e5b23e165aa4c7723073ebe2c2e7da0'

* commit '10d4c5e55e5b23e165aa4c7723073ebe2c2e7da0':
  tiff: set the correct return value when check_size() fails

Merged-by: Michael Niedermayer <michaelni@gmx.at>

Merge commit '3c27275c1309190f2d6ed69140b67d014215b6c9'

* commit '3c27275c1309190f2d6ed69140b67d014215b6c9':
  tiff: Check the check_size() return value and forward it

Conflicts:
libavcodec/tiffenc.c

See: d50aa006fb3430bedc3872ba10e028a714499625
Merged-by: Michael Niedermayer <michaelni@gmx.at>

Merge commit '4690e01c3aaf495c87127e5dc74aa347197dbc0b'

* commit '4690e01c3aaf495c87127e5dc74aa347197dbc0b':
  prores: Evaluate all the quantizers

Merged-by: Michael Niedermayer <michaelni@gmx.at>

Merge commit '490a3ebf36821b81f73e34ad3f554cb523dd2682'

* commit '490a3ebf36821b81f73e34ad3f554cb523dd2682':
  matroskadec: Fix read-after-free in matroska_read_seek()

See: 33301f001747d7a542073c634cc81da5eff051cf
Merged-by: Michael Niedermayer <michaelni@gmx.at>

Merge commit 'd75190aa93206c02cb4f18a66d2c927d6a0198e1'

* commit 'd75190aa93206c02cb4f18a66d2c927d6a0198e1':
  mpegvideo: move REBASE_PICTURE where it is used

Merged-by: Michael Niedermayer <michaelni@gmx.at>

Merge commit '63fcedcf01247f15b72c0d1f959bb3b612853ba8'

* commit '63fcedcf01247f15b72c0d1f959bb3b612853ba8':
  mpegvideo: remove unused function declaration

Merged-by: Michael Niedermayer <michaelni@gmx.at>

avcodec/hevc: Print an error if luma_log2_weight_denom is out of range

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Merge commit 'b2bece5e9a4dd96142962c6798e187c77b88bbfa'

* commit 'b2bece5e9a4dd96142962c6798e187c77b88bbfa':
  hevc: always clip luma_log2_weight_denom

Merged-by: Michael Niedermayer <michaelni@gmx.at>

lavf/concatdec: handle NOPTS start_time.

Fix trac ticket #3598.

Signed-off-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Changelog: Add 10bit spp

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avfilter/vf_spp: support 10bit per sample

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avcodec/avdct: support >8bit per sample dcts

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

doc/ffplay: remove duplicate threads option, this is documented in codecs.*

Fixes Ticket3610

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avformat/xmv: Check return code of ff_alloc_extradata()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avformat/flic: se av_freep() to avoid leaving stale extradata pointer

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avformat/rtpdec_mpeg4: Use av_freep() to avoid leaving stale extradata pointer

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avformat/xmv: use av_freep() to avoid leaving stale extradata pointer

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

tiff: set the correct return value when check_size() fails

Only one instance affected and solved as other occurences.

tiff: Check the check_size() return value and forward it

Also use the same type for add_entry and check_size.

Bug-Id: CID 700699
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Signed-off-by: Vittorio Giovara <vittorio.giovarao@gmail.com>

prores: Evaluate all the quantizers

Prevent an uninitialized data access.

CC: libav-stable@libav.org
Bug-Id: CID 703824 / CID 703825
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

matroskadec: Fix read-after-free in matroska_read_seek()

In matroska_read_seek(), |tracks| is assigned at the begining of the
function. However, functions like matroska_parse_cues() could reallocate
the tracks and invalidate |tracks|.

This assigns |tracks| only before using it, so that it will not get
invalidated elsewhere.

Bug-Id: chromium/427266

mpegvideo: move REBASE_PICTURE where it is used

Drop an unused #undef from h264 decoder.

mpegvideo: remove unused function declaration

hevc: always clip luma_log2_weight_denom

Its value shall be between 0 and 7 according to the specifications.

CC: libav-stable@libav.org
Bug-Id: CID 1257502

avformat/assenc: Use av_freep() to avoid leaving stale pointers in memory

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avformat/avidec: Use av_freep() to avoid leaving stale pointers in memory

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

configure: create the tests directory like the doc directory

This fixes an issue where the tests directory is not created for out of tree
builds before its needed

Tested-by: Dave Yeo <daveryeo@telus.net>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Merge commit 'bab8d73765238bfeea7a8dfd454f40ac213b3d22'

* commit 'bab8d73765238bfeea7a8dfd454f40ac213b3d22':
  vaapi: wrap codec specific functions in appropiate #ifs

Conflicts:
libavcodec/vaapi.c

See: f2118d44c9f18b3245bec2415c563d94201dcf5a
Merged-by: Michael Niedermayer <michaelni@gmx.at>

Merge commit '5a82ad644f281701eb22e0359fd732fac67aafa4'

* commit '5a82ad644f281701eb22e0359fd732fac67aafa4':
  svq1dec: Unbreak the scratch buffer allocation

Conflicts:
libavcodec/svq1dec.c

See: 4213fc5b9eebec53c7d22b770c3f1ceecca1c113
Merged-by: Michael Niedermayer <michaelni@gmx.at>

Merge commit 'bcbdeb318e0828cf00b458885ffa1e1596c85d06'

* commit 'bcbdeb318e0828cf00b458885ffa1e1596c85d06':
  asvenc: Forward the error instead of asserting on it

Conflicts:
libavcodec/asvenc.c

Not merged, conditions which are impossible should be checked by assert*()
adding impossible to be true error checks has the potential to confuse

Merged-by: Michael Niedermayer <michaelni@gmx.at>

lavu/frame: fix malloc error path in av_frame_copy_props()

The error path frees all side data, but forgets to reset the side data
count. This can blow up later in av_frame_unref() and free_side_data().

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

configure: Set the default for --shlibdir to --libdir.

Fixes ticket #4183.

Reviewed-by: Ivan Kalvachev

vp9/x86: sse2 MC assembly.

Also a slight change to the ssse3 code, which prevents a theoretical
overflow in the sharp filter.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

lavf/mxfdec: Fix memleaks reading corrupt files.

Fixes ticket #4173.

Reviewed-by: Tomas Härdin

lavf/mxfdec: Factorize mxf_read_close().

This will allow to fix leaks in a subsequent commit.

vp9/x86: 32bit and sse2 support for vp9 inverse transform assembly

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avformat/dv: Use av_freep() to avoid leaving stale pointers in memory

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

cmdutils: use macros for device test

Signed-off-by: Lukasz Marek <lukasz.m.luki2@gmail.com>

lavd/alsa-audio-common: mark default device in device list

Signed-off-by: Lukasz Marek <lukasz.m.luki2@gmail.com>

lavd/avdevice: use better option types for caps options

Using dedicated types allows to use format/layout names,
not just raw int values.

Signed-off-by: Lukasz Marek <lukasz.m.luki2@gmail.com>

Merge commit 'fd665f7f48fa7db89eb9a93ac33919f6adc40f9d'

* commit 'fd665f7f48fa7db89eb9a93ac33919f6adc40f9d':
  avconv: Use the mpeg12 private option scan_offset

Conflicts:
ffmpeg_opt.c

See: e479013ae41050ad9b76429d8c6ab70684cddc93
Merged-by: Michael Niedermayer <michaelni@gmx.at>

Merge commit '559fa0d41b5cf8f7e1ba89d1ac70e74712eb2816'

* commit '559fa0d41b5cf8f7e1ba89d1ac70e74712eb2816':
  vdpau: add mapping for H.264 Constrained Baseline profile and fallback

Merged-by: Michael Niedermayer <michaelni@gmx.at>

Merge commit '8502c1e9ff9c1dbb6e467630c048d098f4064021'

* commit '8502c1e9ff9c1dbb6e467630c048d098f4064021':
  vdpau: add mapping for H.264 Extended profile

Merged-by: Michael Niedermayer <michaelni@gmx.at>

Merge commit '8b51bcfed75721e0d20832e5a90e1d585318c9d9'

* commit '8b51bcfed75721e0d20832e5a90e1d585318c9d9':
  vdpau: revector macro to reduce line span

Merged-by: Michael Niedermayer <michaelni@gmx.at>

Merge commit 'e10e6651b50b4087f08813f3e503620db7413d3a'

* commit 'e10e6651b50b4087f08813f3e503620db7413d3a':
  thread: use "" instead of <> for including the w32pthreads wrapper

See: 32eadfe453c32788ea57968e6e80f673f434739d
Merged-by: Michael Niedermayer <michaelni@gmx.at>

vaapi: wrap codec specific functions in appropiate #ifs

Fix linking when only a subset of vaapi decoders is enabled.

Bug-Id: 760
CC: libav-stable@libav.org
Signed-off-by: Rémi Denis-Courmont <remi@remlab.net>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

svq1dec: Unbreak the scratch buffer allocation

The input packets are always assumed to be padded and
the av_fast_ family of function takes a pointer to a pointer.

Thanks to Nicolas Dufresne <nicolas.dufresne@collabora.com> for
a similar patch.

Introduced in 7b588bb691644e1b3c168b99accf74248a24e3cf.

Bug-Id: 766
CC: libav-stable@libav.org
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

asvenc: Forward the error instead of asserting on it

Bug-Id: CID 732997
CC: libav-stable@libav.org

avformat/utils: Do not update programs streams from program-less streams in update_wrap_reference()

Fixes Ticket3686

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avformat/mp3dec: Name the dummy variable as what it is, to avoid confusion

Found-by: nattyzs <nattyzs@163.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

avconv: Use the mpeg12 private option scan_offset

Introduced in aed790070486b1b01b48106310d9d0ca1730e459

Bug-Id: debian/773055
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Signed-off-by: Anton Khirnov <anton@khirnov.net>